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Abstract of JP 2003258910 (A) 

PROBLEM TO BE SOLVED: To realize intrusion 
route analysis which is applicable to intrusion using 
a steppingstone and intrusion using a false 
transmission-source address. SOLUTION: A packet 
gathering device 104, etc., records the header 
contents of a packet sent through a network as 
header information and a host internal information 
gathering device 111, etc., gathers internal process 
information regarding internal processes of a host 
112, etc. An intrusion route analyzing device 124 
receives the header information and internal 
process information and a data management device 
123 manages data as a database; ; when an 
intrusion packet is detected, the transmission 
source of the intrusion packet is detected by using 
host level analysis and router level analysis in 
combination and when the transmission source of 
the intrusion packet is a host in the network, a 
packet which contributes the generation and 
transmission of the intrusion packet is specified by 
taking host internal analysis of the host to analyze 
the intrusion route by using the three analyzing 
processes in combination. ; COPYRIGHT: (C) 
2003.JPO 
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[0015] flWEB&«7cftm8®*H\ mm-om 20 

^M^LT, ^IE77^X^77Mi:#£tl/oM 
flTtl P7Fl-XtS^t, ^IE7?-t:X^77 FOl 

[0 0 16] ffi!E^77 MK&SPti, IWBSSfflTCtttflffl 
[0 0 17] ffi!E^77 MX*^ MEjIff^M 

km l t ffEffiis©^ y ymmmm mm t 

f5o 30 
[0 0 18] M!E^P£77^X|SSM?f/T7X7Att, M 

^XtHtM»?g£ftgP7n-fcXt#?gi; LThXHU HX 

M!ErtgP7n-fexli?g£§frf 5 i: i: fete, SfiLfcrt 
gP7n-fexlf $8©f£fr 5 ftgP7n^X«WI©Mf^ 
&5f^ MSB«P7p -b Xtf ? mWiK U 3IK 
L/crtgP7n^Xlffg?:ffl^TrtgP7n-bX«*fS!ia^ 40 

[0 0 19] tatEftgP7°n^xlf?M§P^ MfBrtsP 

7n x» 6 $ -3 rcMsm. my° 
n -b xif i 9 c t mm tt^o 
[0020] m^mrfn^.mwsMmt, mmnm 

w^u^m^mmMKMLmmm-fu^xm^ 
mmzctmmttZo 
[0021] twi7 7^xssm?*t7X7a^ m 

©*7 Y*7~7-%^iBmtt%m(D^jE77--t7,m$< 50 
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fS*r7XrA fciUBWCfc 0 , fifHffi©TO7 2 
gSS«*f 7X7 A <fc 0 , KflBti&fiD* 7 h 7- 7 rtl?^(±S 

7-fcX^7 7 KDfigfiKS^ fftEfffi*7 F7-7^ 
iE77-feX/N77 h©}lfH7MMa^T9£^# 

CO 0 2 2] Mta^iE77-fcXHSM?*r7X7-A«, ffi 

Yv--7*mBmtt%m(D^iE77^7sm% 
m 7X7A i:iiM«rtiT*£ o , lafajifiTt^tHsaagp 

^#S«^iE7 7 -bX^7 7 h t-3^TMl7t^(±ST- 
tftA^o /cif^t, MIBffi©TO7 7^XgSM?*f 7X 
TAtMLTtuHE#S©TO77-feX^77 FCMItt 

[0 0 2 3] *^Bi5t^5T^77-bXM¥*f*S 
it, ffiSt/^77 MSfH^f^#51S©r-^«ia 

sai*#«ymso* 7 h 7 - 7 mm t u mhh^ 
7 h7-7t^sn5^-rn^©r-^^asBt^L 

T^IE77-feX^77 h«I$n/c±I^t, ^E7^ 

mn o ^E7 7 * xmmm mx% o t, ttfis* 7 

h7-7^1t§^77 h^gmu ^E77^X;^ 
77 h&B&rfS/^y hSSXr77 3 ^, MfH^77 
hEUXr 7 7°K X 0 ^E7 7 -bX^7 7 h *^*PSn 

ffc\ BfTg©^^^ Mfa^it©r-^5aasB©a^ 

#S«T-^5!iagS^E7 7^2X^7 7 FClflfc 
t L T^HJt S }lfHfc^ffi5aax r 7 7° t , MIHJMfHfc 

^(±i5nax7 7 7t <fc k> wfc<DT-mmmw&?FjE7 

7-bX^77 h©3Sffl7ci:LTtttfl*nfe®^K:^ MIH 

MHTt^tb^a x 7 7 7t <fc o lam $ n/c r- ^ saan 

B©rt^7n-trXt-3^TPWI^f-3T, TO77 

TfiErt-bWrv F4MH7°n^X^LT^(±S-75 
3tS«^K:^ ff!HTO77^X^77 F4 
^mm^n^XKmm^'^y FSfH7°n^x^fti 
U ^fH L/c IfffH/ ^7 7 hSfH7°n^Xtfc'^TSfH$ 
tlfc^77 F^iE77^X^77 F^LTllS-TSrt 
^ntXMlXf 7 7°tm L^ tff!HMl77^(±S 
®ax777a, MfBrtiS7n^xPWIX77 7°t 
<fcy^iE77^X^77 h©llS^f^n/c±^t, fl 

ssn^iEr 7^x^77 h^mmmmmm 
octmmtt%o 

[0 0 2 4] 

[%Hj5(©^ffi©^i] l.gi imxmm 

*fi/X7A (TO77^XgSM?*f7X7A) ©^f*H 
7X7A©g/jNJ|ifi^LTt3 1) , M9(DXo KZtl? 
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-ess (Mmmms) o 0t*5^r, i o HjgM 
©S*, l 0 2 \iW$^t)^y$~^y Y<^gm,xv 
l 0 3\i^y%-^y k 10 7, 113, l 
19li;l/-£, 1 0 5, 1 0 8, 1 1 5, 12 0HHIA 
«$P§IB, 112, 11 8«#Xk 111, 1 1 7fi 
*X r-ftMfMISB, 104, 109, 116, 1 
2 1 &A>ry MKiMSB, 10 6, 110, 114, 1 
2 2«^7"*7 r-7-7, 12 3ttf-^tim 1 
2 4 «MAHSM¥*t SBTS So -9-7* «y h 7 10 

-?H*Xb (SIM) fc*©fl&©ga^*fc:«fcoTJg 
j££ft5n~#;l/*y hy^fcgfo ^T^y h7- 

* (MM) ;l^*£«fcoTfflSg$&LT^5o m 

Ji^flfjits to-pttac^, 1 >y h 7- ? s 
<9, Sffilo©/^7 h«SB*EB-tSo 

*7sYmmm7*vYv->7\z\^ mi& 1 o©g 
a«§b^#£l, &*zhK*zhmmmm 20 
B^^Etstofc-rSo h 1 KBt&xti&mw 1 0 

5, 1 0 8, 1 1 5, 1 2 0, *Xh«f$g^*SB 
111, 1 1 7, MK&SBl 0 4, 1 0 9, 1 

16, 12 1, HAIiSS»*fgB 1 2 4£<fcD1ftfo*ft 

[0 0 2 5] HI tfct^T, MA#$PSB 10 5, 10 

8, 115, 120a, ^ft^fttimstift+w 

iA^^7b (^J£7?-feX^y 30 
XP- 1 1 2, 11 8©rt$7P^X^frtffi£i£SiU 

m^fu^Kmm ? tcmsimxm 1 it tm 
utzmffiKmtZo ^vmmmmmi 1 

1, 1 17«, Wfn^tt5*Xh©Wn 
•t x t ig-r 5 * X h ftgP'lf ? g£M L , L 7c * X P 
ftgPlf ?MAM?*T§SB 1 2 4-NjIflf-So *Xh 40 

ftm»?M§SB«, m^vtzxm&mmmm 

5o MIX^SBI 0 4, 1 0 9, 1 1 6, 1 2 1 

# # , m? 5 o tail l tc <\ y ?<o v mm t »f 

mxmmwm 1 24 a, vmm£<o^y 
*x h mmmmmx <o *x p w^its 

»*f&tf *x p i^^;v»*f?:tf t\ *x p mmmim 50 
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ot*xhrtgp»*f^f9o mxmmmmmi 2 4 
a, MtTt^tHMgp t «gP7°n ^ x» wigwag ^ 

112, ii8a, r-^sanSBt, ;P-5 107, 

113, 11 9(i;^7 h«SB«l^f-5o 

[0 0 2 6] ^tdijfft-D^TfMt-So Sf, MAS 
SMfWSBl 2 41:'MAgSS»Jf^lT-3/ci6©¥fi®Pg 

wtz&immmoo *>ry vmmm 1 0 4, 1 
09, 116, 121 n^n^nmm^nri^^y 

*>yp7-7 10 6, 1 1 0, 1 1 4, 1 2 2*SRnS 

m^tl&Wv h^7^rt©%fl7tE thevTYU 
X, 5a5feE t h e r7KL-X, I C M P 7°n h n;Wvy 
^© Type, Code, Checksum, I P 7°D 
h3;Wvy^(7) Identification, TTL 
(Time To Live), Protocol, % 
flTtl P7F^X, P7FPX, TC P/UDP 

^, Checksum, TCP^OhnM-^OSe 
quenceNumber, Acknowledgme 
ntNumberS H©1f fg^^tf 0 *X h ftgP'Ifffi^ 
*SB«*X h^©7°D-fextaif Si: LT, ^n^x 

•fexigij?, ma.—vm&, mn=L-^rmm, %9 

;b-7°iigij?, HtT^>-7°lgiJ7, mfTlUZh 

0Bf, ffifmiTHBf, fflfH^I P7H>X, ffifH^TC 
P/UDP^hS^ MfHN I CtfiJO^TStlT^ 
7c E t h e r 7 K t I P 7 F UX, TC P/UDP 

^cDtisasTOtr-^gagBi 2 3-\Mi^n 

5 0 -r-^^aggl 2 3aSfHL7cr-^^iI@^ 

[0 0 2 7] MAHSSMJfSB 1 2 4 a, V 

1 0 5, 1 0 8, 1 1 5, 1 2 0^B©MA^Pfg©^ 
%4 L/c^tc:, gas 7c K <fc o TMASSM?*f 

^r^i-So tctcu MAgw/f^r^t-sBMtfe 

^T, MA^PB#|iMfit/^7 h«SB 10 4,1 
0 9, 116, 12 lMtftd, *Xf«««8I 
111, 11 7tj;oT«$n7cr-5a, SSSftlt 
7-^taSBl 2 3-\Ml^n, Ktr-^^-Xt 



[0 0 2 8] CCTfi, HlMtft, m 4 L % ^ 
MAHSM?*flSBl 2 4T*?rfcft5^AllS&jB*TX 
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^x^-^^-vy^^n^n^mm^m (414, 

4 15, 4 16) JitgL/cfeCT-feSo H4£fc^ 
T, Mtiimmi (414, 415, 416) _k©fi£j& 

fcl^T, 4 1 4(»Xh^«tT^ 4 1 5&*XF 
4 1 6«;F-£W;Fi?fr£*LT^So 

[0 0 2 9] *x f u^;M»«Ttt, mkWsmwKz*) 
mtetirnxwy YK^nrcmm 1 P7 ffx 

<£5 0 Ftffcfcfcfcf R F C (R e q u e s 10 

t for C omme n t s) T«£ftScfc5&iI 
ff 7° n F n ;F £ L T t ^ t >fr £ 3 ©8Ptff t> fr -5 „ 
^7 7 F©^7^ff6tc^ft?>58fHfcI P7F 
FX^»<:*7 F7- Wg§Mf£% I P7 FFX7 
£Sfr£3fr&£©f|Sg (DNSC#IW>y hiJl 

^■eMeaaftW-tssffi, i p7ffx£»? 
tffl^tSo -7f, ;v-?F^;Mtt, h« 20 

mzvmmntc^ymmimmE ther 

7FFX, ?5ftE t h e r7FFX, TTLfcg"^ 
T, HA^7y h*«L/c;^^*Ha»tJI^lo 
T^A^7y F©lff^^7S»fFm??&5 0 ;l/ 
-*WWjB*rtt, P7FFXtcJ;P>f ! » 

*f a i p 7 f iszmmftfd^-e&m. 
\z>^y F©m-Fx v t^mimm^t^m, 

^-©jifH7t^th5aatfs^i-So *xFft 30 

MA^PSBt egJti/c^t, f#£ £ 
ft/c*x h©rtgp^n-fex«r£W/f u ^©*x f# 

fcfc&fc, ^©;FXF^§ff L/c^7<y F©5SMA^ 
7 7 h©4fiSc&MltH^L/c/^7 F£f#/£75» 

So 

[0 0 3 0] Hi ©MASSM?*T§SB 1 2 4 ««T©» 40 

mmm <fc m»7©*ff tffio tm ahmt £«i 

feL<t«»775o *7 F7-7£^ftS^77 F^rSS 
}ILTt^5 M A«$P§SBfr 5 A&ftfilftl £ o fci§ 

WLTHfTfS (4 0 1, 4 0 9) o *XF© 
F WVMtixi&Tft (402, 403, 404) , ^© 

*x f f^7«mf tmKMWiztifav-zwwm 
ifctm, 4 o i tm^nrc** f wmviKtt so 
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75 4 o 9T«£ft£;F-£ W;WB*r) W* 1 
*XFF^/«©im:£D, 7XF«?*t© 
m £ * 5 * X F #M AHSM¥*f gB©^STF K F?F£7 
Si§£-fc7 7X F F^;WS*t ©A* £ L/c^7 7 F ©If 

m*7iK*zvmiffir*fflm& (402, 40 

4) 0 ^©fto^a*Xh«?*f?:r^L^^ (4 

03) o ^-z^mwmn (410, 411, 4 
12), ^(Dji-^^Mmtm^mmntc^x 

F F^/FMF (ft t * f£, 4 0 9 T:-»?ftfc;^ 2 F 
^VMIftWtS 4 0 1 ff«2ftfc*X F F^7» 
*t) tf*»7$ftfci\ /b-?F^;«i§im#Sftft 
/^•y F»7X h©%fH7tE t h e r 7 Fl^X^O 
*X F ©7 F FX F^^jf©^^- ^ L/c 

h©^fH7i7 FFX^S^Sii^Mtf'tc;, *X h 
rtSP»«f ©*fit <h 5 * X h AHS«ft¥*f SBCtS 

mmmz uiu 412)0 ^©fto^^tx 

hrt*l»«T*BIS&La^ (4 10)„ l©^, ih^k 
r^$ti/c*x F i^;M»*tK: ioTKtBWX h K 
mt 5*X h rt»F7°D-tX^HCT7-feo/c±I^ 
(4 l 2) ta, ^©*Xhrt^*f7n-feX^7f 
5 (4 0 7) 0 *Xbft»/fH7fft (4 0 5, 4 0 
6, 4 0 8) , &ZhftWtffii<DXj3£L1trt>ryh* 
m&L1t7ui>*&, *y h7-^*lSL/c^SB 

/c/^7-y h^SU #SL/c^77 FfcjUjfctS* 
x h F^;FM*ffc<fct) ; ';F-^ F^;V»jf*^]B#tEi)7 

§ (4 0 5, 4 0 6) 0 ^©ftoif-a-a^XhF^W 

IF, (4 0 8) o ^ 

n&^T©»WI^7L/c±^t^ASSS«*f©ll 
7i:^*7 (4 1 3) o 

[0 0 3 1] ll7 04^L/c#tJtO^TffifJ-r 
§0 tctcU fIS7, Hff?n5$XhF^m 71/ 
WVfflrl&^f tl^«*X F t"Q^T©*X hft 
^»*f * Rl^7 <fe § ^ 9 laH^ff 5 ft 5 © ^ 7 5 o 
^tf£, »fi*ft?»*X FrtWFiaHa, 4 0 7 7H 

7$fts««fii 4 0 8vmtmmm^T, *x f 

rt^»*f©fIt«MLT>7X F F^;V»*ft3 
F^;F«lf^f nJfgT^S ^t^iaH^fSftS fe© 
fct 5„ *7 F7-^^ftS^77 F^SMLT^S 
MA^PSB^SilA^»P^£0, 40 1W4 0 
9 tfc^T^X f F^;FP*f F^;V»*f 
tH^^ftSo 4 0 2 tfcW^X F F^;V»*f^7 
U *XFF^;«©£II, MA^7-y FCjlfH/t^ 
FT, tlASSg»*fSBi;^]F*7 F7-7tH75* 
XF©^fft^^t±l$ft5 0 K77«, MAg 
SS«*f SB ^ -y F 7- 7 tcJi-75 *X F * ftgF7 
X F ^!H7o S/c, 4 0 1 -4 0 2 ©*X F F^;F»*f 
7^fF^ft/crt^7X F^ft^tX F A ^^75o 4 0 
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2 Kfctvt** h Wl/iffiT tmi L/c £ K, f*7 L 

ti5o *Xr-ft»jT?«, *XFl^;l#*T?Mi2 
5 0 4 l 0£fe^?;V-£]^;VfS*r^71^ 

m^ju mn^YAffmhrc^yhcDo^m io 

A^7 hC^j^tf^KIB^Lfc/^ h («T, 

h tm) m^zn^o a o 5?*x vn 

^;l#*T^^c«2tl£o 4 1 IC^T, 
^l^;l#*W^7U I^IMJtcdSSH, MA 
/^7 r-cDjIf3^L?ft»X hBtf&tfJSftSo b 
-2 WlfflrKi. *) h B#Wi£tift©?, 

ft»X h B©TO7 0 D^X«/£{ciO^T*X hrtgpjg 
*f^HSS&Sn5o 4 0 3T% *Xh^;Wtf 20 

HfcftftU 4 l i?^ff*tife*Xhrt95|»*T*«R 
t5 0 4 0 6?, *XhWlT^7L, rtSP^Xh 
B^ff L/c/^7 r-©5^A^7 hCMWl 
€£H4Lfc^A/«$-y hfffifcZti&o 4 0 6?*X 
Fftg«^7L/ccD?, *X brt§«££D#£ 
£ftfcMA^7 MdtfL?, *x h i^;i/ft?flri;;i/- 

£i^;b»^ft«f«£nSo 4 0 4?, 

u^;MB*r^7L, *x h u^/iM/rcDSSm, HA^ 30 
>rv FOIIjtilt L?ft»X h C tf&tijSftSo 
% LT, *X h l^;l/fl?ffi?fttfJ£ft;fcrtg|5#X h CCD 

5 0 -73, 4 12?, ;b-^l^;b#fir^7U *X 

h ^;v»*f?^i±s$n/crtgp*x h c as^srtSP* 

XhDAW^')' hcDMB^L?Mi£ti5o CCD 
±§^, ;b-7 l^;b»*r?cD^(±lf£||«*X h 
*T?CD^(±SiaH <fc 0 feMt^t^cD?, h C 

7 l^;b#*T ?^(±S 2Wc ftgp* X h D CD P ^ X 40 
t3^T*XhW«»5 (4 0 7) o IS 4 CD 

fj?a, *xh«?«fcDian, rtgp^xbcDMA/^ 
cd?, ftgp^x h B&km^mmrcimm^m^ 

J£7T3#&£*LT^5 (4 0 8, 4 1 3). 
[0 0 3 2] ;l/-^P^;bffi(fcD5!ia#]ItO^ 

o^T^-TSo MASSM?*T§SBJi, MA«MBt 
<fc0, Wh^ciA/^-y htf^2ti;fcJg£^ ft 50 
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£P£ ti/cMA^ 7 h cd^ 7 7* t r- 7 gagScDr- 
7^-Xfttf§ffl£n?t^7 7Wg^lt$xU E 
t h e r 7KUXiRtfTTL£RMMIA/^y h©^7 

^7 71S Ether7KWtTTL K^cD'lf 
#H1A^7 hcD^7^^-g(L?t^cD?, MA^ 
7 h tHfS^7 ^l»fg?£S ^^^5 c t^?t So 
-?"L?, ttfH^n^7^fSf6t-3^?}Ifl7tE t h e 
r7KUX, ^Ether7Fl^X, TTLcDMfrg 
S^li^lS c t fc<fc 0 MA/^ 7 h cDMf Tt^^tHf- 
5 0 K7^, ^-^l^^;«cDS*^^J|ia?£?, 0 
?tt, H5, K6Mtft, 07^#K8L^5, 

[0 0 3 3] H5t$5l^?, 5 0 1^5 5 0 5{i*X 
h, 5 0 6*»5 5 0 8tt;l/-*^ 5 0 9^5 5 1 2 {*# 
^#§^|g^7b7-^, 5 1 3*^55 1 6&/^7 h 
iKftSS, 5 1 7 afiA^PSB, M 1 1 Hi# 
WlOE t h e r 7 Kl^X^gL?t^ 0 

[0 0 3 4] H6t$3^?, 6 0 1^5 6 1 3a^tlf 
tl05CD*X h 5 0 1 frt> 5 0 4 CDff 4 OCD^X 

5 0 5 (E t h e r7Fl/X : M 1 1) ^^7 
hcD-\7^^<^L^ (E t h e r7F^X&tfTT 
L*^<) «f/^7he(MLftit, 05(D^A^ 
*PSB5 1 7^P-T5^^7h 6 0 8, 6 0 9, 6 1 

2, 6 1 3<Dmfr*m*-tLTT-$^-mm 

f#S>tl/c^|g*^7^l»«cDT T Lffitc j;o?^H 
l/OBKLT&So 'Ny^iSBttfiBiLh^ ^fl/tE t h 
e r7F7X, ^E t h e r7Fl^X, TTLffi^, 

znzmvm i cmp 

7°d h 3;l/^\7 ^cDType, Code, Checks 
um, I P7°n h-3;W\7#<7) I d e n t i f i c a t 
ion, Protocol, %fH7t I P7FPX, ^ 
I P 7 K UX, T C P / U D P 7°n h a>W\y jtQffii 
7t#- FS^, jS5fe^- Mt^, Checksum, T 
C P 7°D h a;l"\7 ^CD S e q u e n c e N u m b e 
r , Acknowl edgmen tNumbe rSCT 
#$tu H6?(iX?S!H) cD4-3tKHiJL?g$n 
5„ |7M5^T, 7 0 1 ag|6cD;^7 h 6 0 

7 0 2ttH6©^y h6 1 2 mdi'^yYQ 

1 3 ) 1 l?;v-7 wmazftv tcmx 

[0 0 3 5] ll* H6CD;^7 F 6 0 9CD7V-7 
WVffli%ft 5 £fccDT§ 0 ;^7 h 6 0 9^i?^ 
-^L?r-^^-X^^fo/ciaH?:I P7°nFn 
/KDTTHlCio ?^Hf 5 £ H 6 CD <fc o 

[0 0 3 6] r-^^-X^tiOffSn/cia 
St#Stl5^7 7'lffficD9^, /^7 h 6 0 9CDTT 
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F 5 0 5ST-©gS§J:T-a, /^ry F©5S?cI P7KU 
X^Sff L/c/^7 h©TT Lffifc^g/MaSt fcfc«fc 
5 0 LWoT> T T Lfiii: LT 7 %W~0?^y F 6 1 
2 fc/^y h 6 1 3tt, CCT-r-^^-X^lg*^ 

[0 0 3 7] TTLfW-y F60 9 i;|W]C. 8©fe 

TTHB^8^Wft£^7^f?gfr^ * 10 
^T7h6 0 9 ^%fl7tE t h e r 7 FbXMtRK Jg^fe 
E t h e r 7 K UX^U^7 $fittfl«D'\y ^ti 
**«3l1-5o LfttfoT, rtfry F 6 l 0 £/^7 F 

6 1 1 tt iiu-er-^^-X^IS^^SM^ti 

So 

[ 0 0 3 8 ] T T L 9 ©^7 ^tifgtO^TM 
m*ft 0 o Sf , T T L ffitf 8 £££o/^ y h T'floT 
^§^7^1*16 F 6 0 9) cD^fS/cE t h e r 

7 F F-X££fo;F-5 5 0 8 WJo^T© E t h e r 7 
FKX£!^S„ COfct, ;F-? 5 0 8(iMl 0i:M 20 
9£E t h e r7FkX£LT&0£^frfrSo & 

0S/caM9*5S^E t he r7FkX£LT&0/^ 
7F6 0 7£!KU SU^BSUfSo Lfctf-iX, /« 
^7F 6 0 5, /^7F60 6, /^7h60 8li, C 
c r- * ^-XttsRjg^ p. «St£ ft 5 o 
[0 0 3 9] ffit, TTLit9^;^7 hT*$ 
oT^S^7^'t»S W7 F 6 0 7) ©JSAtcE t h 
e r7FkXM8£E t he r 7 FkX£ LTf£o;F— 
7 5 0 7 ^ffO^T© Ether/F UX£!^S 0 C 30 
©fct, £50 7&M8£M7£E t he r7FF- 
X £ LTSfOil £fft>fr% 0 T T L fflfti 1 0 

m^n^y^\m(Do^, m8s/c«m7^5S^e t 

he r7F^X£LT&O/^7F6 0 3»KU S 
0£fK£T3 o Lfctf-iX, /tyy F 6 0 K h 
6 0 2, h6 0 4tt, ££T'7-7^-X}M£g 

[0 0 4 0] TTLfEl 0%&D/i>ry FT-feTt^ 
(^7" 7 F 6 0 3) (OmtjiE t h e r 7 
F 3£Ether7FkX£ LTWoA^&lflft 40 
^TOEther7Kl/^I^S. LfrLfttf^ 
MSltA^&iflfrOE t h e r 7 F>XT"«%l^/c#x 
M3^E t h e r7F^X£LTRT3;F-£«#itiJ2ft 
%(7 0 /^«?h6 0 3li, E t h e r7FW 

fcibt, ^7" 7 F 6 0 9 *X F 5 0 3fr5%ff£ 
ft;F-£ 5 0 7 *5<fctf;l/-# 5 0 8 JCoTfMt^ft* 
X F 5 0 5 ^iJlL/c , m 7 © 7 0 1 ©IgJIftW 

[0 0 4 1] H6©^7"7 F 6 1 2 (feL<fi/^y F 50 
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6 13) tdHLTiitE^H^fo/cil^ H5©* 
X F 5 0 1 £*X F 5 0 2 fcfeK/^y F©%ff*X 
F<hLT#S£fU H7©7 0 2(DXo^^n^tl 

[0 0 4 2] £U:<?)«fc5fc^ ;F-71^;F»#t^ 
yh<D \ P7F^Xt ( fc5t'MifS:tf9©^\ I P7F 
L-X£!^£ft/ci§£T?&EItMA^7 FCjllH* 

[0043] tern msmmb^^mx^y 

F ©fffg^OTA* t 1 S *X F ft»JT©t«tT 
7 0 H8tt5^T, 8 1 oa*XE > 801 

^P) 8 0 7 tt*X F 8 1 0 _ht?Ei)$rL/c7°n-feX, 8 

ik 812 limmw, 8 0 8 izw$mw8 1 1 ^© 

IMMtfK, 8 0 9iiW8 1 2 ^©jlff^fflS 
ftft*XF8 1 0±O51^-h*gLT^5o 
^gpgBi:«, ffi©*XF£ft&;F-££Ir«1-So 7 
n-feX8 0 1^5,^-^X8 0 7<DWKS, ffl©7D-t 

x t j; o x m m 2 n tm t mm l /c tu t ^ a , ^ t> ^ s 

7 0 n-bX©il?Mf^^f3S^TKSo ft tZ.lt, 0 8 
tfeKT, 7°D-tX8 0 5, 7D-tX8 0 6«, full 
X8 0 4 t<fcoTjESl*nT^5o COf^, 7n^X 
8 0 5fij;&7D-feX8 0 6^7°D-feX8 0 4©?7°n 
•feX, T^n-feXS 0 4^7°D-feX8 0 5, 7°n^X8 0 

6l7*ntxi«o *XF8 l oanSPS 

B8 1 lfrP>ttgpgB8 1 2«f«©»&* 
XFi:LT«ffl$n/cfe©^tSo 

[0044] 1 2©»&t9^o 

*X F L^/FiMfffc L < a, ;F-7 ^;W$#WMt 
WiTfcf7 ^ir©ISH, F«*XF8 1 0©il 

F 8 0 9A^aSM*n^C fctf#5££nT^5& 

i;LTT-7^-X^^L, ^©Bt^t*XF8 1 0 
©iifH^- F 8 0 9*mLX^rcfutt OVrv F 
4fi)c7°D-tX) ti-rsiffg (7°n^x4fiSc0B#, 7°n 
-tXHTHBf, 7°n^XfigiJ?, il7°n^XilHiJ?, H 

/U, ^fnvyF7^X jifir^0B#, jlfHUTH 
ilfH5feI jlft^TCP/UDP^-F 
ffifHN I C fctJirdrrSftTVfc E t h e r 7 F 
UX£IP7FF-X, TC P/UDP#-F#^) ^# 

•fex^f^nro^c^) a, wtnrmm, mwm 

0B#, fflflTfel P7FI-X, ilffftTCP/UDPtf- 
F#^ MfHN I CtiJO^TStlT^cE t h e r7 
FKXi:IP7FUX, TCP/UDP#-F#^^ 
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*y vm\mmmt%o >^y v^mfu^m 
mmwfr (ommK <fc s iift^sti lt^&^ 

[0 0 4 5] h4j&7°n^XfiW§tBfr5©g 

7n^X^il2tUs^7 0 P-feX (^b-r^ 
XrA©#m7n^X) Cfc^f)f<St\ ±!B©M 10 
mm <3 M Ut 5 o Il7°n •fe X ftfc^ 7°n -fcX 

[0 0 4 6] 0 8©WJT'(3:, 7n-feX8 0 3*WSB 
5 i S L T t 7°P -feX * 5 tc 

J6, 7n^x 8 0 3 tHf £tt?6*^+-i: LTf- 
^-X«SU 7°O^X8 0 3/WSSBfrP>§tf 

[0 0 4 7] *XbpW7n^Xtlf6*OTA^t 
5 *X b (*XF ftg^lSSt 5 HA^PSB 20 

±IHO / ^ y h <7>l»f8£M8A7J fct 5 *X h rtgp»*f 

©*x h±tw? h%^f$itc7°uiix\cmt^m 
iffg^OT a^ 1 ? s saa t m-cti % 0 

[0 0 4 8] tt±©<fc3 *X h U^;HSIt, 

X r- rtSPIf S^r- * taSBT'-r- * ^-Xfc «fc »J & 30 
^tatS/cfc, *X r- l^;Ht?#r, /1>-#1^;1/)B*t 
Mm;:, *Xhrt*jB*T*fr3ISK:, ftASKlBtftNi 

[0 0 4 9] HSS©^12. u±.<n%M<DW& i T*ti, 

iis t 15 1 1 s m At h l r & mmm tt&tc & k , * 

LfcT-^^HPWc&k:, A§«©Miffiii£fi« 40 
H L t ^ <£> 5 fc KT© <fc 9 & £ <fc 0 Wa. 

Km^ftZ^try b^7^rt©%fl7tE t h e r7F 

l^X, Jg$fcE t he rTKUX, I CMP7°n 

7^© Type, Code, Checksum, IP7° 
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L, Protocol, %ft7Cl P7FU-X, 5S?g I P 
7FUX, T C P/UDP7D hn/K-y^s^U'tl; 

Checksum, TCP 
7°n h UjWsy ^©SequenceNumber, A 
cknowl edgmentNumbe r) /clt^rfHS 

^*X hrtgElff^xmUBT^BftlfffiKm?:^^ 
-TSo ^^^©tl^fe, ft¥*ff-5^XTA©A^^tj; 

[0 0 5 0] 1%ftUW?&T-Z<Dm* 

a, iffl-rs^xTActtt^m^, mMznmm 
[0051] mmmrn 3 . 1 itft 

m©^l2T1i, '>&< tfe»*f^fai»fc^T 

/^-y MxffSBMm^, ^^XbTOIffMSB^ 
iRft L/cr- Bf r- ^-XtaHBtf&lftt- 5 

y MX*SBMtft, ^*XhrtgP1f^X»SB^«» 

SB^S-^tiaSf-^ (/^yhOiSSMtf^ * 
Xh±©7°r3-feXt»fg) *T-^taSB^lflLr- 

[0 0 5 2] W±©HSS©^l3tJ;tia\ WkT-Z 
oymtmm&Rlb K> , HAHSS«*f*lltf Bf ©r- 

^tasBJ:© 1 ; y-xtc^tst# (e«^§im 
[0053] mnmm. u±mmmm3?n, 

(/^-y h©1SSMmc, *Xb±©7°n^xlffg) ^ 
r-^gagB^fHLr-^^-X^ffl-rS <: ^ 
T\ M ASSglS*? *Htf Bf ©iRft r - ^ ©ftftff Sfcfr 
o/co ctitiP^, h«SB±t;V-^^ 
;b««fffit^m<:, ^*x brt#P1fffi«SB±t*x 

i^ia /c^t a, M ASK)K*f Bft M AMSSMJf It 

[0 0 5 4] W±«HSS©^14 t itlff, *7 
^±K^LT^S#/^y b«HBMm-, #*X 

h m^mmmm^^mxmm^mm^m lt^ 
wmmmvi?% 0 in^r, mm±^yYmmm 



21 

[0 0 5 5] mM(Dl&m 5 . &L±(DmM<DlfM 1 ~ 4 T? 

it. 'it -^fi^Trt^rr^i«4')ijo/-^4rvc'rx</r^)fifliT' 
h-jfctax mxmmmmmimm&z> 0 

X\ MM 51:1^ MMAS^BfTiMfl^ 
T, <fc 0£«H^MAHSM?«f^f a tfSKo^TffflH 

[0 0 5 6] B9ttW, 90K 9 0 2, 9 0 3(i 10 

z\ m maMhwmm&\, (> <> l nor,, 9 
o 6 izmmmxmmtmu 9 0 k 902, 90 

3»M?*Mi^*7 9 0 7-9 1 O&ft 

AHSSJ:©*Xb£gLT^5o ftfe, &*yh7~* 
fcfc, HCiLfc^i; ftA^PSB, /^7hi 
ilSB^IEB S ft T ^ 5 fc o 1 5 #*X h WfcilS 
•SBfilkfc: It/WyVZ Witt 5 Jg&<E>;l/- £ L 
T^5o H 9 m *X b 9 0 7 *a*S*B*i: U # 

b 9 0 8 *3 £0^7, h 9 0 9 LT 
*Xb9 1 0£#*L;fcfcfiDfcT5o 20 
[0 0 5 7] ftAHSg«#TliB9 0 3 (i, f^C^ST* 
ftAIM^fiS/ciSII, *Xb9 1 0^\£D^E7^ 

Mi, ftA!MrSB9 0 2£<fcoTltt 

6SiS<rfe^7 h"PS5i:»fS-r5o c©tt, ft 
AHSS»*fSB 9 0 3 tt, * 7 h 7- 9 9 0 5 5* y 
b<7-7 9 0 Q^m^Xtfc^y WifflZStStiL 

mmmxmmmwd 0 2 tamu 

[0058] mmzmt-mmmmm 9 0 30 

2«, ftASSS»*TSB9 0 3fr52&5ftT£fc/«$-y 

M»fg^t, mrnmm 1 ~ 4 ^-r^s^oTft 

AHMif^f^o eofct, *yh7-*9 0 5±© 
*X h 9 0 8 fccfc^X h 9 0 9 SftfcC 
fc, Md, *X h 9 0 8«ftAOT?#T§B9 0 1 

m^mm^y \>y-f±.<Dmw ($xfs/cs;^ 
40 frhm:iznrz>y'rv yx<mmwz> urn. 

0 3 Kmm& 0 
[0059] 03a, rnxmrntn 

mm 9 0 2 ©js^iu^s tis, ftAHSMaa 9 40 
0 2^b^^7 vm^mmmmxmm^ 

§SB9 0 1 U ftAgSg»«f©l»l!^ffiffi1-5o 
[0 0 6 0] ftASSM?*T§SB9 OlTt, ft AM? 

*fg«9 0 2 tmKmxm$mmm\ causes© 

[0 0 6 1] mfflftK, ftASSM?*T§SB9 0 3tt, * 
7h7-^ 9 0 6©»*f£H, Mtffc:, ftAgSS«*T§§ 
B 9 0 2 , ftASSM?*T§SB 9 0 1 frZmZtlTltrc 50 
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ISJllfr *X h 9 0 7 £>#X h 9 1 0 £X(D-M(D 

mxm%m&% 0 

[0062] u±(Dmm(DBm5Kxna, mw&x 

[0 0 6 3] U±<DmM<DftM 1 -5XH, 

mnmx&& 0 

[0 0 6 4] CCX\ mM(D&m 1 ~ 5 L/cftAH 
[0 0 6 5] HffiCMI 1 ~5 ^f-ftAHSM?*f^X 

1. ^SBfrWH^§fH&L<«, gi)feL< 
JR&U KSU ^SBti;§!HSr-^jIfIg*% 

ifBf t l < a, siwc^gB^faSr-^^MSf 

2. ^gpgB*^©#^SfffcL<S, gi)feL< 

n -fe x © -fe x hsmjie t H-r ?> its (cns^i 

^LT*Xb«»|g^^il^^5) ^X*L, HE 

H\ SSHWfi: ^SB^fagr- ? mm 5 *X h ft 
^fiffSMIB (ffi&nJt^) 0 

3. h7-^±t#ft1-5^^y h«*SBMtf 
*X brtgMSffi«SB^fHgr-^^fHS*^f 

^t»fgiK«SB^S>jim$nSfagr-^^SflL, r 

4. ^SB^6©0^SfHfeL<a, gf)feL< 

mmjLxmmmx&mxmmtmu mm 



5. w-tm'm^i^v v^mLiii* 
x hmmmmm&ctxmxttmiiu mub 

[0066] mmmm i~5Kmmxmm^>7s 
fAit ^y$m$mm*~tLXT~$^~mm 

T T L (Time to Live) f^, IljtE 
t h e r 7Kl"XMtffc:, t h e r7KUX*ffl 

^xmrnzctmrnttZo 
[0067] mmmm 1 ~5 ^t-ftAM?*r>x 



(13) 
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[0 0 6 8] $ >iP \m 1 ">( - J 1 1 ' . ill, ."i f\i ' 
[0 0 6 9] 

M©xJjH] tUiCfc?^ ^M^fttf, jKHtl 

m7°tmxMmmm? rob, 
TztzK&ttmmm*), mmmommm io 

[0070] s/c, *5»<fcti«\ h-mit^* 

[0 0 7 1] Sfc, *5»<fctUi\ ^yh<om& 

^^^IffSStfTO^O-feX'tffgcDlB^cD/cfe 20 

(omwmmmmt s c t # ? t s 0 
[0072] s/c, *%ro;:£nfi; ^y^isffiacfrt 

So 

[0 0 7 3] $fc, *5»<fctUi\ «SfiD*yh7- 
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[H 1 ] MA£?SM?*f ^XrAo>>XTA«fi!»^ 
Ho 

[02] «©M5Wi5-T5Ho 

[03] fi£*©gffi«#r 5 Ho 

[H 4 ] gAIMMft^S^- u > VmBt^o 

m 5] ;b-£ ^;l/jg*ffl^^-rs/'cfc©'>XT 
A4ffjjSc0 o 

[H6] ^•y^1t$g©0J£*m 

[H 7 ] £ L^/14?#t ©HSUcffi J^/^fHo 

[H8] *7.Ymmimmmtz>Tc&(D-fu^7s 

HigHo 

[h 9 ] mmmAmim^yzT-Lm^tcmmn 

i o l im%<vm.s 102 gss, 103 jy* 
-*7K 10 4 MK&SR l 0 5 MA^ 

fcJ&g^ 106 ^7"*7b7-^ 10 7;b-£, 1 
0 8 MA^PSR 109 /^yMKiMgR 11 

0 V7%vYV->7, 111 *XbM'|»fflX»S 
Bs 1 1 2 *Xk 1 1 3 ;b-£s 1 1 4 

yhy-^ 1 1 5 mxmwm., l l 6 Wyh 
mm, 1 1 7 *xb[«tfMi§B, 1 1 s 

*XK 119 ;b-£, 120 HA#MB^ 12 

1 >^yhHmm, 122 U-^7h7-^ 1 

2 3 r-^taSB, l 2 4 MAHSg»*fSBo 



[03] 



(15) 
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C I ■» I " I » I » 1 
C I M3 1 117 1 10 1 1 1 
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